+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Infected by Trojan.Win32.Agent.nfboam (/showthread.php?tid=5726722)
Infected by Trojan.Win32.Agent.nfboam - crimezy - Sep 28, 2017
Hi there!
I accidentaly ran a malicious file that opened and installed plenty of garbage on my other PC.
Now I find myself scanning with Kaspersky Total Security and Malwarebytes (that first found 170 new infected files) but it seems like there's a process in System32 that's called xudate.exe and gets deleted by Kaspersky and then appears again. I just can't remove it even in safe mode because it comes back every minute.
I'm willing to scan and provide logs if you need me to do so,
thank you in advance!
* - 5chn4pp - Sep 28, 2017
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Right click to run as administrator. When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.
- Please copy and paste the logs back here.
* - crimezy - Sep 28, 2017
Hope that .exe I was talking about is still there in the logs and was not deleted by my antivirus in the middle of the scan. Seems like it comes always back though.
Addition.txt
https://pastebin.com/ZcKXesHT
FRST.txt
https://pastebin.com/F6HNP09v
Thank you.
* - 5chn4pp - Sep 28, 2017
Download fixlist.txt file and save it to the Desktop.
NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
----------
Please download RogueKiller and save it to your desktop.
- Quit all running programs.
- Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
- Read and accept the EULA (End User License Agreement)
- Click Scan to scan the system.
- When the scan completes select "Report", a log will open. Close the program > Don't Fix anything!
- Post the contents of the log in your next reply.
* - crimezy - Sep 29, 2017
Alright, here I am!
I followed what you said and got the logs.
This is the fixlog: https://pastebin.com/QTx2dnce
and this is the report from RogueKiller (hope the language isn't an issue): https://pastebin.com/EyRE1YrL
* - 5chn4pp - Sep 29, 2017
Make Roguekiller delete everything it found, then please post fresh FRST logs so I can see if it worked.
* - crimezy - Sep 29, 2017
Seems like another file xxdate.exe is detected instead of xudate.exe by Kaspersky.
FRST is here: https://pastebin.com/WzWaAhwz
Addition: https://pastebin.com/cmuGd0Sg
Thank you again in advance.
* - 5chn4pp - Sep 30, 2017
C:\WINDOWS\system32\Drivers\DrToolKrl.sys
That file is very interesting to me, its probably the rootkit that drops the files, could you upload that file and send it to me for analysis?
* - crimezy - Sep 30, 2017
Seems like I cannot copy or upload the file anywhere because access is denied. Seems like that file is kind of new and could be causing the problem.. What should I do to show that file to you?
* - 5chn4pp - Sep 30, 2017
Try this:
Download fixlist.txt file and save it to the Desktop.
NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
* - crimezy - Sep 30, 2017
Seems like the process can't be stopped.
Have a look: https://pastebin.com/m8P66KB0
* - 5chn4pp - Sep 30, 2017
Please download Malwarebytes Anti-Rootkit and save the file to your desktop.
- Please rename the file MBAR.exe to abc.exe
- Right-Click abc.exe and select Run as administrator to run the installer.
- Select your Desktop as the location to extract the contents and click OK. The program should open upon completion.
- Click Next, followed by Update. Upon update completion, click Next.
- Ensure Drivers, Sectors & System are checked and click Scan.
- Do not use your computer during the scan.
- Upon completion:
- If no malware is found, close the MBAR window.
- If malware is found, ensure Create Restore Point is checked and click Cleanup. Reboot when prompted.
Two logs (mbar-log.txt and system-log.txt) will be created. Copy the contents of both logs and paste them to pastebin.com. Both logs can be found in the MBAR folder. - If no malware is found, close the MBAR window.
* - crimezy - Oct 1, 2017
I followed the steps and I found something but I don't think it solved the problem..
This is the log: https://pastebin.com/xKYma21Q
* - 5chn4pp - Oct 1, 2017
(Oct 1, 2017 03:25 AM)crimezy Wrote: I followed the steps and I found something but I don't think it solved the problem..
This is the log: https://pastebin.com/xKYma21Q
Doesn't MBAR create 2 logs if I remember correctly?
* - crimezy - Oct 1, 2017
You're right, I'm sorry.
This is the second log you're asking for: https://pastebin.com/2xHFhm0D